IPv6:Check the outgoing hop limit value

When specifing the outgoing hop limit as ancillary data for sendmsg(), the kernel doesn't check the integer hop limit value as specified in [RFC-3542] section 6.3.

---
 net/ipv6/datagram.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

index b9c2de8..0f0f94a 100644
@@ -705,6 +705,11 @@ int datagram_send_ctl(struct net *net,
 			}
 
 			*hlimit = *(int *)CMSG_DATA(cmsg);
+			if (*hlimit < -1 || *hlimit > 0xff) {
+				err = -EINVAL;
+				goto exit_f;
+			}
+
 			break;
 
 		case IPV6_TCLASS:

In article <[email protected]> (at Tue, 10 Jun 2008 15:50:55 +0800), Shan Wei <[email protected]> says:

I'm going apply this in my queue. Thanks.

--yoshfuji